Finding Hidden Parameters With Arjun and Burp Param Miner
An endpoint exposes GET /api/profile, yet an old mobile client once sent includeDeleted=true. The UI no longer mentions it. The backend still parses it. Hidden parameters are often abandoned features, debug switches, alternate object selectors, or proxy headers—and they are invisible if you only click through the current frontend.
Arjun and Burp's Param Miner automate the guessing. Their output is a lead list, not a vulnerability list.
Gather names before spraying
Read JavaScript bundles, mobile API traffic, OpenAPI files, GraphQL variables, error messages, and archived URLs. Product vocabulary beats a generic dictionary: if the app calls teams “workspaces,” try workspaceId, workspace_id, wid, and X-Workspace-Id.
Build endpoint-specific candidates. Parameters for search differ from those for invitations. Smaller lists reduce WAF noise and make response changes easier to attribute.
Arjun for query and body discovery
Arjun sends parameter groups and compares responses to infer which names the server recognizes. Start against one stable endpoint:
arjun -u https://target.example/api/profile -m GET
Use the documented options for POST data, custom headers, delays, and wordlists. Import your authenticated headers only on an account you control, and remove volatile telemetry headers that produce a different response every time.
Baseline stability matters. Timestamps, random recommendation blocks, and rotating CSRF tokens can fool differential detection. Repeat a candidate manually with and without the parameter. Test a neutral value, then a type-changing value such as false, 0, or your second account's object ID.
Param Miner inside Burp
Param Miner works well when you already have a representative request in Proxy history. Right-click and guess query parameters, body parameters, cookies, or headers. Its bucket-based probing reduces requests by testing groups, then narrowing when a response changes.
Header discovery can uncover X-Original-URL, X-Forwarded-Host, feature flags, tenant selectors, and debug modes. Be cautious: cache-related header guesses may affect shared responses. Use unique cache busters and skip high-traffic pages.
Param Miner also spots unkeyed inputs useful for web cache poisoning. Keep that test separate from ordinary hidden-parameter discovery so your report explains whether the issue is secret functionality, authorization, or cache behavior.
Turn a name into a finding
A parameter pays when its value crosses a boundary:
userIdreturns another test account's private profileincludeDeleted=truereveals records normal users cannot accesspreview=trueskips payment or approval statedebug=1leaks stack traces, keys, or internal routesrole=adminchanges server-side authorizationfields=secretKeyexposes properties omitted by default
Use two accounts and one planted canary. If accountId=A while authenticated as B returns A's marker, the proof is clean. A response growing by 14 bytes is only a clue until you explain the data.
Noise control and reporting
Rate-limit yourself, especially on serverless endpoints where each guess costs the program money. Avoid logout, delete, purchase, export, and email-triggering routes during bulk discovery. If a candidate causes errors, stop automation and inspect manually.
Your report should name the discovery tool only after the root cause: an undocumented client-controlled parameter bypasses authorization. Include baseline and modified requests, response diff, account setup, and impact. Recommend explicit request schemas, rejection of unknown fields, server-derived identity and role values, and removal of dead feature flags.
Use Arjun's official repository and PortSwigger's Param Miner BApp documentation for current flags. Wordlists find doors; careful manual testing tells you whether any door should have been locked.